SUSP_OBFUSC_PS1_Bypass_Jun20_2

Rule Info

Rule Hash
4e27850711e3ee9f2b84e60c6f78b368
Score
70
Tags
['SUSP', 'T1086', 'SCRIPT', 'OBFUS', 'T1027', 'T1136']
Reference
Internal Research
Name
SUSP_OBFUSC_PS1_Bypass_Jun20_2
Date
2020-06-27
Required Modules
[]
Author
Florian Roth
Description
Detects PowerShell scripts that show signs of obfuscation
Minimum Yara
1.7
Av Ratio
12.34

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
144
Clean (0 engines)
0

Rule Matches

Hash
Total
Timestamp
Positives
VT
77a2a554ea761b9ed65339af32ce8545f32652c5d39ef61f5b9b3e54f62072ca
59
2020-08-04 01:27:46
7
4d3c40bc9bcba5b0d360adc0fa1ccb015ff8f7588cd10dd9a39b8d70b206215a
59
2020-08-03 21:11:12
9
4dd803f868d8829a9f272de9a098186e4ee54c31d7f797dc67fca6d62af11605
58
2020-08-03 14:55:13
8
bb2663c8610f1656f5f7550a5be5d7f1659de00b810999173ad6ac354ed55aef
58
2020-08-03 03:52:01
7
7e0c934563b8a2e1bd02f31e1c854526742c72b1d6f20ff5bdb6ea7cfc365724
59
2020-08-03 00:34:43
7
469170649320d52a5b5b045d0d9e15bf243d5cde5a8fb8d1f9189bb4e21032ac
59
2020-08-03 00:30:36
9
389777ce645c812da4c743b4ca3b8b13557d03de0105eb3c3b2b7b0c30cf00f9
59
2020-08-02 19:56:03
8
c7fed81c110727ea304d5596111d251375ce749ea860db564a324e007497b02b
54
2020-08-02 17:07:23
6
b6d63c19a2d396aca0f8947dd713c88a45aa0f6cb6454f488cb023158fa55e7a
54
2020-08-02 15:47:45
6
dcf2632d385fea35e410364f7228f36eeab631a45322615823bebab1864fd8bd
59
2020-08-02 15:38:40
7
d904514c06eb6364b8554f4150157a6510e45f71f5c44fa8ab9cea126c2c5c93
57
2020-08-02 04:41:26
8
9c48be56ce4bfe37aab21a1520ea05f8bbe97f05b607039aecc4d107a8f3f8f8
58
2020-08-02 04:33:44
8
9f358807d255f7584a6ceda68fb2b7253b15be0ac2fa8b87fa37164630ffd21f
58
2020-08-02 00:42:27
6
6830d67f697b9a7066b5b7a359099df40e670cfc4589192032e8127d2073f2be
58
2020-08-01 23:02:34
6
78e664d59f0feaae84d9c42183f121cf10c2b9bc7af1443e2e5a72eca57d3eaa
56
2020-08-01 20:54:14
5
173d1b02e95ec8fad8769d3816c0af275b1e55eff01b08e0dbe132624467dae3
58
2020-07-31 01:30:07
6
ea58d7474f93c88e892e11b5292085b319e7108aec23e32f5fc1d5690b53329c
59
2020-07-30 09:22:49
7
f4e65f231fbe569cff2e5eccef5ea147c78201670ffedbed6b12202e2747583e
57
2020-07-29 19:53:14
5
ca51cd6e33a73cf053b787ac7ccee9f5c5973339ec3f968a221655f25c5371fa
59
2020-07-29 18:24:38
8
a1d9b3e0ac150785eb8bda3f80a939eebd054a6e8eb1a974359577bd587d28bb
59
2020-07-29 18:04:24
7
66576ff22f41e2ee7a409963abf82fe703133875e9024d8932c900d11c280c7b
59
2020-07-29 07:25:34
7
ecad102f767002f2972d8d932fab3eeab4276a0f11ad9b734bd5cec96b71ee15
57
2020-07-29 00:32:58
6
f9c8f02b68c0ad28278241da69c2cccb6e20c1adfec4caa892214cb629af5640
58
2020-07-28 23:55:12
8
a9ca5dd1f857b6ec880f29fde178e24b64446a3bc7b41bd6d1d76736f12e692e
59
2020-07-28 22:22:06
8
e10eb340ac91e13fa82c02040e9f6f4379592355dd83b713b4f9139ade63b37f
59
2020-07-28 17:07:32
8
d4f8feeaf612f3c79e35db9e9c83b3e0bd2570212da207868c25d6b0ed3cec7b
59
2020-07-28 10:14:51
6
11175a2eaaee18f937bdc4044f20af85c2ffefce369422d0ea77a6623974d3ad
52
2020-07-28 06:25:48
4
b19062127675ecb17339febc0996a16ebd0d1118bf0970b3a18ee45e35b86b80
59
2020-07-28 01:10:02
7
d44070f3e9412e00ff36586f50f3e125b7b22c8638d481f9aac89ac47ded4ebb
58
2020-07-27 19:15:00
5
2fd2fb42e02e8125624fab36f12f256524d600607562bf0ce741ea45c7215fab
57
2020-07-27 01:58:31
8
42f020b32e6f0e4fdd2910763c79e6c7c15432dd0a6e59fa2fb5e8d6bb6b5384
59
2020-07-26 15:03:01
8
833c28ccdbbce75424cfcd7f38e88acdaaea578b4b1b8648b5c4d5043a68fddc
59
2020-07-26 12:26:04
8
b63699f2c4d419653d476bf7407ee90eb5b2abb00e1f8d7b2be4d15ff7de2a21
59
2020-07-25 22:18:41
6
6c28268354651ae8303d606652ec8861b50c866e0cb5b6202aeadff3c33e4c0d
59
2020-07-25 19:07:29
8
84eb716bc1b89612a78ff3c8069799b424d775d2d472a931755cbdd9bce133d1
58
2020-07-25 13:12:41
9
79f24b50ece5686b6b46dff59c6a291ff17bbf89e78e440b6151e3e187ca3f13
59
2020-07-25 02:36:38
6
6314eda8c7be125167d910fe870a72efee9bfec5e13b1b4a03c1617fd92b7e0e
59
2020-07-24 03:39:04
7
6dba84c49a822512dbbdc0a9610dedf4a5a76fc1e5a500c647049d3ad9b43342
59
2020-07-24 02:32:37
8
fe90556750fa59ff19c957edb1a30d96c03c991eeacd64a8397262095bea4576
59
2020-07-24 00:22:25
7
e74d39a9477a4dba89f6e48d78156ed0be19365f633adde0a16eeaf8d9285edc
59
2020-07-23 06:28:57
8
a1289511566ea0d91e931568907ac8fdad52ed6d8bd60ded3758923ee6858f22
57
2020-07-23 00:20:25
8
69df27bd13b8217b79df9a53ae7bfd01bed9a301884d2aee45db3a340750da6f
58
2020-07-23 00:19:55
12
07cb00c6340391efb2de87fd0346aef82e6aa5f5e0285c0e4a593bed7b387f8a
57
2020-07-23 00:15:39
7
833ee7be9876431d8207190ea899a671c3a4381bc85f4c7efffdc4a1bc95cf78
59
2020-07-22 22:09:01
7
104c479fba3b3020ac7fce1667398af2fda86174823820f56a73041a449cfec9
59
2020-07-22 07:57:13
8
f873e489219b847f83ce97f358650cb803038ef644b0c069f01451b2188e837a
59
2020-07-22 04:30:05
7
5d79d103bdfcf6555d58989f8e69ca59d66eb0517f936a060dd16acaf75720cc
59
2020-07-21 20:25:37
7
85f04e6b8c7063dbefcdcf7b1cfa2a6728ed966632ef0954cf1235547048c59b
59
2020-07-21 18:42:52
5
9827e824eb3a7ca29aa00aa717f961c07a610ac87eaa3d2a0fe84d3e67dec90f
59
2020-07-21 15:26:49
7
337a8fa75f2f83b5ef9b78ef30e2ead2bbf71157a54f059eadf893ab86c87a09
59
2020-07-21 12:28:04
7
63353d10ba735e9f538e7d0cbceaacebda2fdd204ca3bb12e46b52808d18cf8d
59
2020-07-20 22:20:12
5
4d182109a70eb39d7c251339e9712b25df72f0dcfd579d888f98a6cd1b1de704
59
2020-07-20 19:28:51
8
772d2a80a33046edde3a7cb3bfe13283af6009f64d2bd345c100b8abe6745a4c
59
2020-07-20 19:22:12
8
aec34f945cd2ac499d8b037ee21ae0759fce7b180c9362ab8961506bd14a8298
59
2020-07-20 17:04:43
4
cd486ad162af8c90305b68ed23867e3e685f9d372d64cb15cfceee9a26cc1c3a
59
2020-07-20 15:45:42
7
667f2e424d0199c40304ec8a26187fc75baecc8faece05f23c560a00bee6524a
59
2020-07-20 10:26:10
6
5b06aecbf2e2672322b21e684848f6fb249391fcf4925c690d53c8b2e8810f01
59
2020-07-19 07:27:22
8
6f94f7f9a96522ca6c23a479a202b82fbec53bb08dacafc01aaf4f1cf738815b
59
2020-07-19 02:11:47
8
526075ae2af22f1da632f3941ca11537d373d4802c2eb353b0309e0450614b5a
58
2020-07-18 08:10:57
5
806eb7007776833b79132c12a255359162a7376d0fdfa3e798bf1a2b34ab59fd
59
2020-07-18 02:06:38
7
e4fad34218833de0586291b9ad04d1cc20172557d237817dd911fd5697c987e8
58
2020-07-17 20:39:41
6
cd1790809b9220d975ed6e5688054ee9a7b0c104cad862532a2920010d390bd5
58
2020-07-17 15:43:13
9
e4841357232f93a7d75a83710126ef1616a782143a4d969d49da0d0b7b6f6bcd
59
2020-07-17 02:15:18
6
f39cbe16067febe2acde315cd5946c9c7838d2090bfc7aae8a66383677f54433
59
2020-07-16 22:10:23
8
6f043082d8115873dcf7c4b2f2973df5ca0d232c50afe09b5da7905890aee1ad
59
2020-07-16 19:23:38
6
b835799fa8225d188c1fdcdc4db215493b55f1050a7a374ce3f18886e38d76c7
59
2020-07-16 01:42:02
8
8205020056fa980fa85e3230591dbd22ea0ecd1d7c3b88da628b05572602b3ee
57
2020-07-15 22:01:47
7
1b28ec955be286dde3907c2bdc9f1d1094ca10c6a5d01c1d9e343279fd26cd3f
59
2020-07-15 19:37:26
7
edf72df3122d35fc13abf6d34be47e079d255b3fc3b5bf01cbb13198520d4ea0
59
2020-07-15 15:53:49
6
d1df77de76c8fc11ca0ae1d2ec6be743bb87c4ae40dd15c3089c99e1c36028cf
59
2020-07-15 15:48:29
8
4e3c73ecba8bf1c3d6b2ddda2c701769e77c9aa3bf0835fe0f4c4797c21f4b24
59
2020-07-15 15:47:26
8
e4e1f0a36f85261907097c853be9e4ca8b0bcbbbf42a31e740d7439b751669a1
49
2020-07-14 23:28:24
4
552488a1ce366db6031b4c0988b537dfb450b20eaffefb44960ea86934c8a22c
59
2020-07-14 01:24:12
3
b0c952606f116b14c93b7082a6aca9b5eb745ebe98de2819bb849a048a531468
57
2020-07-13 22:49:27
7
23b98cf8737f39220184f73d01ad9d9be7d9af9e635160d66d9cae7456e1995e
57
2020-07-13 21:21:15
7
af1cd6d93600083a3835f163620b655b7242c66970ecf4f14414722dc77068dc
58
2020-07-13 19:40:13
6
cf154bffaf999c88e8ea4591027451c3a8b91b1e8acf0f5aac0e91b06b285ef8
59
2020-07-13 13:06:25
7
1d665b4e6289fd522518a3ce7f101ce1a973b802af964172c7359cc04ff6e2e0
59
2020-07-13 12:47:40
7
bab8c3764acd4d402a5c6a27b5ac5f29bd44bf88715d0afa56b778566d6c006b
59
2020-07-13 10:01:00
8
d606341eb20a95c8b92b6e10e1a637d5cfdfd0d363f81b0f2941e3a80f125433
59
2020-07-13 07:21:54
9
462d220c9b8a1f8c1cf5884d6a04690a8a458fc9d5cb26535ef24bffbec99f4e
58
2020-07-13 03:51:23
8
303b86facf1701d8c8dba3aed351aa1220edd7dd1f339adc261d08545fa1e3fc
59
2020-07-12 23:42:21
7
0593b220a4f3f552a7377437ce016ae2b97bb781c605ebcc6b78922f28c45b2c
59
2020-07-12 10:05:16
6
cb972fb9397d8b0a138d69a8bba6aeb5ed04c0c2ac073f37526000c33c3b25d1
60
2020-07-11 19:18:29
7
c7a4287a1fff4e797c0e7b2e080165d1149e009b100abe119d4b3e080bd03bc5
59
2020-07-11 14:44:40
6
f2f778983489b1094715919749755da006d971fd3e91b6f8c2aadb25d4e44ac6
59
2020-07-11 08:23:21
8
14966c47cb08997e52a375743dc45c3ca3beb34ec9e55f75a88803ce124a79a7
58
2020-07-10 13:18:36
6
250db275267ddb4be657495c31e38b1405eefdfdf5feab78ca6da549f511f9a5
57
2020-07-10 11:57:11
6
4847f19f0cc8c2fbdbf402c4dcc7594369e4c613a2aeb992b4f08626ea883347
56
2020-07-10 10:32:00
7
eb6f596fafb0a21160b4ecf89ba37f19809d6bc1f00ff362a6f75e4dff1f2652
58
2020-07-10 10:26:31
7
c92949da7882c84c110812f94e90f89932bf32861654f66f65a0df3ebce6a6c7
58
2020-07-10 07:27:09
7
70a7e9a1314e3da5e7b8ccb42627e74387916070983da0b5d97773d7a8567222
58
2020-07-10 07:07:26
7
d468c60ccc575f3c552af1317198e60baff98bd69c0984120b2d8955fa30d9cd
59
2020-07-09 18:30:35
6
cc830bf08e2bbab6ab27a43ec042ea9bde6a09471d9527420bd65553b537753f
59
2020-07-09 17:20:18
7
ee778e26874e2d0847c446adcc631fc6084885c595e272e18ae317e172ba9587
59
2020-07-09 08:16:50
9
63497224141e6ec2c251f1dd5a7b2994f9defb9c7d370990a7a2ce890e98083d
59
2020-07-08 18:49:14
8
b43a799d6908f78a5379ae5ce48c0f6778259ad1125af8c09cfda4031f84cdd9
59
2020-07-08 16:11:42
9
dcec553790a989b67807c6dc818f1180279cf09f25233a4f675df2d88dd64ae9
57
2020-07-08 15:34:32
7
d8aaae4c318227ecfa0fef6da108af9a3ca6bf0957169240f4e34a36dd13fa0c
58
2020-07-08 08:43:06
8
f9eda19f4bc34a47d259f525615c15b7880e4e58046ea56855a1ff02b815b8ba
58
2020-07-07 05:01:19
6
48c625736ad2f625e810155f47d4cc7a19674ae96a67be8900731ae4922fb7b5
59
2020-07-07 02:58:02
6
d978e56d67e0eee989932c001a83ea1a521eb2a7c2fb1cdd28e323e5f39b9b0c
58
2020-07-06 22:51:43
7
bb646fd6546f9891a3a3c83e2a667f6e56e8d1c7684085972a563dd4c5d7379d
57
2020-07-06 20:30:02
4
f14d964f4bba31540d639aad096c5c1d7ec7d37cc9aab21964c2847df48fd2e2
59
2020-07-06 17:18:53
7
48e21c6003a3de82ad4d484983d2d55160ee02cd376295a08b875c6166fa0b0e
58
2020-07-06 16:51:28
9
1614c818b99aa60e31e48e65a3cc78d062345c5d7bdab2965d3a653d7f087a1c
59
2020-07-05 23:32:34
7
22126e3b1ab44a65df4eb1302f9b4c1385d141d71bfb0bcd8c3bdf88682c3195
59
2020-07-05 23:08:55
8
ffe1d7f5c117ba2204bb9969dc2daef712023b0d9ea7bb6340fe22948bc3132e
59
2020-07-05 21:15:50
6
e2366538ef0f1060aa7e62e20e288445e8ed08ed3b10b2e4ee245e5539b15aa4
60
2020-07-05 18:14:15
8
35decb8b3823f4fc1a3ea13dbde3f347022c085b6cd51a305f8f71405a2459e4
59
2020-07-05 06:07:56
8
16c6f1e21ec225d241d4fb6bc973ce06260e13cd5acb2ec0c1ab9c0e40e2f9d3
58
2020-07-05 01:26:11
9
4ec53491523e0ad75363e8efb523c548fbbb285b09ad014793c3377c6072612f
59
2020-07-05 00:21:55
8
66f96f20d4e4c05bbb501f655bddac1fc08968e3d603ef3e8b4227fe21c4e550
58
2020-07-04 18:34:00
5
f64af2706e179047393200272348c41f829ca8dcd673072b8536661755d2ac9e
59
2020-07-04 17:50:55
7
d2530d9e030c214efb88144326a32312be4ce165a0e9b4d1efbc9af1b99a3e14
59
2020-07-04 10:04:53
7
626e768f0cccfd4351591ae8214fa46d93ec06c53909503c3b91618095fa2518
59
2020-07-03 19:48:17
8
46dddc8b6e93ea2d86ca9b46c2151b1b411b5ac8f33e68e730beebd2e3a497de
58
2020-07-03 16:48:23
7
9941bb273173403866f1837236a1daa02d715a675876bb10835ffd903bda1b0e
59
2020-07-03 02:51:42
8
152ead6a7b13269c1542f1155eb3d0a7c4225c377d00e5dc142423cf95dcaf6f
60
2020-07-03 02:29:49
7
657e75a592bcbb84f6cdf6201d47135f0cf22aecce5df19bbbdab2afb1bf6102
59
2020-07-02 22:51:19
6
48e8a4ada24dce9d774200d8d9cf8acf6a0663af5408138e40a7b222a5d8febb
59
2020-07-02 21:47:44
8
9e256d36fd8a8653796acc83886a4d54e8aed968a43706814ab7ccbb6e6cb063
58
2020-07-02 16:20:40
5
33e0c06c3de3594f4c69260afc3e9543fa2fde936b613b3c7129e1965d415c6e
59
2020-07-02 11:13:24
5
82048fa21bb8acdc35e378495341c3a42c849a963a6ecccdac259fa098eb931a
59
2020-07-02 02:58:31
6
96d43b794467968859b1a0b87e2e3a676d842e15f083d30259dac3fd5442721a
58
2020-07-01 15:04:42
6
ffa3cc273d53c310807519c6ffde46bfa77b56abb48aeae027dc309fc937415d
60
2020-07-01 06:47:02
9
3216de1aa70b824009d24c6412fcd78139cd10239bf0a1a04572b7d7e75bc3f3
60
2020-07-01 06:44:26
14
3366f9c6e3a1ab44d2371816179cb3b0e23d1d3cfbe48b4666e9d09a141d8916
60
2020-07-01 06:42:05
15
6b1f7ed066578b4a5669f1e15b934bfcff256a40fb99f6c7db1647e2f5cca0a1
60
2020-07-01 06:41:58
15
bb5fe64ba98de7fdf99bd50058045da2f3703a709f2bcd2d6af781891d2beebc
59
2020-07-01 03:50:18
8
0dcd669b764cd22f188b4f0977dcb6dd0c54e5d50a6788f767e40ca31f5dfbdc
59
2020-07-01 02:14:22
8
543617483d2eff50814682604638b7612d841149c392289d74902d36bdb30f08
58
2020-07-01 00:05:10
8
65159b8f0454d3533e694bf786a981e9feb40730ce80ef5133ad921392489120
58
2020-06-30 22:47:28
6
dd51431d85702c847fe6746b951b62a7d27b1dd4d8526d2460e081963fb39013
59
2020-06-30 04:22:23
8
1daaa8c9f553ccfe8da9db4ce0a8e9027991db2f3710030cdbf314f16fc061ea
59
2020-06-30 02:49:11
8
7d36b1cb518e46f6ebad9c9b224d214569e5b005617e4ece2a09c878cea38f8c
58
2020-06-29 21:03:18
8
b6b1a7cff06845cb019c3f1926cebe55b02c07e313cd2c4faea067672fbc6579
59
2020-06-29 20:35:26
7
b28f327030d3069d69597fcb016927707e6c6c526d6dfae33dcb9adb5b8138d7
60
2020-06-29 20:28:55
7
401c1293d96a27bd83b732b93ee88c922562b68b67130668cdca0cb6caca3104
56
2020-06-29 19:55:03
7
d6518a021c4533f4744ac6d894e31613b37376d017f54e8d971e924562453a07
58
2020-06-29 19:48:57
8
1d6c4481929056d15ad4ee7cf9bfe97c7829e27911ef9409a279e042d04f2100
58
2020-06-29 18:24:47
7
f3353659812472d049ce816e03d82362655286177eee3d08d102486f3de01452
59
2020-06-29 12:18:56
6
7220e4ec5b29181f9c9577cc0e2a66442c40c22d41ab869cb567422bb6036ef1
58
2020-06-29 05:48:07
6
5ab8b216cf68be2012cce8baa1b347e1558574806d8d01e29561fb7daa842c12
59
2020-06-28 00:39:46
7
9523ea4b24e3e41486c03dcd5e12a883172479f9178268bdf3dceaf135661445
59
2020-06-28 00:24:56
8
e868b3834b6d2584cc6cb773a51d51bc77606f08256b749f6809330316ccaddf
59
2020-06-27 23:49:58
9
052bf36d75d09f83729e5440bc580880c5f5e2fe2ede010b96f305904569002e
58
2020-06-27 23:23:22
8
c9e3ef98a192adde6df11a4f159b63700f4454bff676e0e12170772921c549cb
58
2020-06-27 10:37:51
7

Rule Matches per Month (last 24 months)